{"slug": "show-hn-stroq-a-local-audit-of-what-your-coding-agent-did-and-why", "title": "Show HN: Stroq – a local audit of what your coding agent did and why", "summary": "Stroq released version 0.30.0 of its local security platform for AI coding agents, distributed as the npm package @stroq/cli under Apache-2.0 and requiring Node.js 22 or newer. Stroq reads the last 30 days of Claude Code and Codex CLI sessions, key files and working folders, prints key names but never values, writes only a small cache under ~/.stroq and sends no telemetry, while its hooks deny commands such as `curl | sh` and outbound calls carrying a known secret and ask the user first when a command repeats text the agent read. The tool also offers a `replay --all` mode that checks existing sessions against the policy without installing hooks, and an `attack` command that demonstrates Stroq stopping 36 known attacks in a sandbox.", "body_md": "Stroq reads your own Claude Code and Codex sessions and shows how many commands came from text your agent read, and which keys left your machine.\n\n<sub>An example: a made-up machine with made-up sessions, keys and hosts. Hoo is Stroq's owl. Your card shows your own sessions.</sub>\n\n```\nnpx @stroq/cli\n```\n\nIt reads your last 30 days of sessions, your key files and the folders your agent worked in; prints key names, never values; writes nothing but a small cache under `~/.stroq`; and sends nothing. No account, no telemetry.\n\n```\nnpx @stroq/cli            a card of your own sessions, like the one above\nnpx @stroq/cli init       stop it next time: guard your agent\nnpx @stroq/cli why        why an action was stopped\nnpx @stroq/cli attack     watch Stroq stop 36 known attacks, in a sandbox\nnpx @stroq/cli uninstall  remove Stroq\n```\n\nEvery moment on the card has a `stroq show` line that prints the evidence behind it (`npx @stroq/cli show 1`). `stroq help --all` lists the other commands. Needs Node.js 22 or newer. Apache-2.0.\n\nStroq is a local security platform for AI coding agents: Claude Code, Cursor, Codex CLI and others. Its hooks judge every tool call before it runs. They deny `curl | sh` and outbound calls that carry a known secret from your machine, and they ask you first when a command repeats text the agent read, naming that text. The console shows which agents actually ask Stroq, and every decision with its reason. Sessions you already had can be checked too, without installing anything.\n\n```\nnpx @stroq/cli console        # the console: a private page on 127.0.0.1\nnpx @stroq/cli replay --all   # your Claude Code sessions of the last 30 days against the policy; no hooks needed\nnpx @stroq/cli sent           # did your agent pass your keys on? key names, never values\nnpx @stroq/cli init           # hook into your agent and guard the next session\n```\n\n<sub>A made-up machine: made-up sessions, keys and hosts. Nothing was executed.</sub>\n\n| **Check** : the card of`stroq` , made by the same code. Each moment opens with its evidence, under it one line for each agent. | **Live** : recorded decisions as they happen. A row opens into its chain: what the agent read, what it did, the decision, the rule. | \n| **Agents** : add or remove Stroq's hooks, with the exact file change shown first. When Stroq was last asked, and which of an agent's settings weaken it. | **Skills & MCP** : every skill and MCP server by agent: where it came from, what the rules matched in it, what changed since you last looked. | \n\nThe fifth screen is **Rules**: try an action without running it, turn rules on with a preview and a test, the history with an undo, and the rules reference. Connected means Stroq's hooks are in the agent's settings, not that the agent calls them: **Test hook** and **Live** show that.\n\n<sub>Screens from a build just before 0.30.0, reading a made-up machine: made-up sessions, keys and hosts. Nothing was executed.</sub>\n\n```\nnpx @stroq/cli console                            # a private page on 127.0.0.1\nnpx @stroq/cli console --workspace /path/to/repo  # the project it should look at\n```\n\nOpen the whole link it prints: it carries a key that is new each time the console starts. The console reads what Stroq already records on this machine. It changes an agent's settings or Stroq's policy only after you confirm a preview of that change; checks you run are saved under `~/.stroq`.\n\nIt listens only on 127.0.0.1, needs no account and has no telemetry. Nothing in it starts your agent: **Test hook** runs the hook once, offline. Adding hooks from the console needs macOS or Linux; on Windows use `stroq init`. Details and limits: [console guide](https://github.com/AGGIB/Stroq/blob/main/console/README.md).\n\nFrom a source checkout:\n\n```\npnpm install --frozen-lockfile\npnpm --dir console install --ignore-workspace --frozen-lockfile\npnpm platform:build\npnpm platform --workspace /path/to/repo\n```\n\n<sub>Output of the 0.29.0 CLI on a made-up Claude Code transcript of the same story; the path is shortened.</sub>\n\n`stroq replay` reads the agent's own transcript, so it works on sessions from before Stroq was installed: which content the agent read, and which later actions came out of it. `--all` goes through every session of the last 30 days and says which to open. Nothing runs and nothing is sent; the verdicts are today's policy's, not a record of what happened at the time.\n\n`stroq sent` compares your Claude Code, Codex CLI and Cursor sessions with the credentials on your machine and says where each key went: sent to another company, maybe sent, seen by the AI, used with its own service, or blocked before it ran. It prints names and sources, never values. Start with the [session secret scan walkthrough](https://stroq.dev/session-secret-scan/) (no session yet? [try it with a made-up key](https://stroq.dev/session-secret-scan/#try-it)).\n\n## What a `stroq sent` finding looks like\n\nMade-up keys, the built CLI's output, trimmed:\n\n```\nstroq sent: did your AI agent pass your keys on?\n\n6 of your 6 keys appear in your agent sessions: 2 sent to another company, 1 maybe sent, 1 seen by the AI, 1 used with its own service, 1 blocked before it ran.\n\nChecked 3 sessions (Claude Code 2, Codex 1), 2026-10-02 to 2026-10-19.\nCompared with 6 keys: ~/.aws/credentials, ~/.npmrc, ~/work/shop/.env, ~/work/api/.env.\n\nSENT TO ANOTHER COMPANY: rotate these today (2)\n 1. STRIPE_SECRET_KEY  from ~/work/shop/.env\n    went to  collector.example, in a curl command\n    when     2026-10-11 14:02 UTC · Claude Code · ~/work/shop\n    do       revoke it at https://dashboard.stripe.com/apikeys, then update ~/work/shop/.env\n\nSEEN BY THE AI: your agent's model saw these keys (1)\n 4. aws_secret_access_key  from ~/.aws/credentials\n    seen in  the output of a Read of ~/.aws/credentials\n    when     2026-10-02 09:42 UTC · Claude Code · ~/work/api\n    note     Not ruled out: 2 later commands in that session could reach the network.\n    do       your agent's model saw it; rotate it if that matters: https://console.aws.amazon.com/iam/home#/security_credentials\n\nStroq names a send only when it sees the key in the command that sent it. A script, a file or a variable can carry a key out without showing it.\n```\n\n`stroq attack` runs 36 attacks, from public reports and synthetic cells, against your policy in a throwaway home: on 0.30.0, 15 are denied, 21 are asked about, 0 pass through.\n\n- **Before each action.** Native hooks for Claude Code, Cursor, Codex, Copilot CLI, Windsurf and Antigravity, a plugin for OpenClaw, and a stdio MCP proxy. Supported outbound calls containing a known secret can be denied; provenance ties later actions to the tool output they repeat. A question about a value copied from text the agent read is asked once per session in Claude Code, unless the session has started something in the background.\n- **After the fact.**`replay` and`sent` read local session records, including sessions from before Stroq was installed. Old, rotated or unknown values may be missed, and a key that did not show in a command may still have left in a script, a file or a variable. A local transcript match does not by itself prove delivery to a model provider.\n- **Local.** No outbound network calls from the hooks; the hook of an older Task Lock run speaks only to its local parent controller. No telemetry.\n- **Limits.** A hook sees only what the host sends it, and that differs by agent and version. Matching is text-level, so a command the model writes from scratch does not trace back to a source. It is a filter, not a sandbox. Read the[integration limits](https://github.com/AGGIB/Stroq/blob/main/docs/AGENTS.md) before relying on a live hook.\n\n- **[Guide](https://github.com/AGGIB/Stroq/blob/main/docs/GUIDE.md)** : everything, section by section.[Install](https://github.com/AGGIB/Stroq/blob/main/docs/GUIDE.md#install) ·[Commands](https://github.com/AGGIB/Stroq/blob/main/docs/GUIDE.md#commands) ·[How it works](https://github.com/AGGIB/Stroq/blob/main/docs/GUIDE.md#how-it-works) ·[Guarantees and limits](https://github.com/AGGIB/Stroq/blob/main/docs/GUIDE.md#guarantees-and-limits)\n- [Per-agent details](https://github.com/AGGIB/Stroq/blob/main/docs/AGENTS.md) : what each agent's hooks allow, and every documented limit\n- [False positives](https://github.com/AGGIB/Stroq/blob/main/docs/BENCH.md) ·[Attack coverage](https://github.com/AGGIB/Stroq/blob/main/docs/COVERAGE.md) ·[Cloak vs AgentCloak](https://github.com/AGGIB/Stroq/blob/main/docs/CLOAK-COMPARISON.md)\n- [Security](https://github.com/AGGIB/Stroq/blob/main/SECURITY.md) ·[Changelog](https://github.com/AGGIB/Stroq/blob/main/CHANGELOG.md) ·[Contributing](https://github.com/AGGIB/Stroq/blob/main/CONTRIBUTING.md)\n\nThank you to everyone who contributes code, reports bugs, tests agent integrations, and improves the docs ❤️", "url": "https://wpnews.pro/news/show-hn-stroq-a-local-audit-of-what-your-coding-agent-did-and-why", "canonical_source": "https://github.com/AGGIB/Stroq", "published_at": "2026-11-05 15:54:41+00:00", "updated_at": "2026-11-05 16:51:19.099291+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-tools", "developer-tools"], "entities": ["Stroq", "@stroq/cli", "Claude Code", "Codex CLI", "Cursor", "Node.js", "Apache-2.0"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/show-hn-stroq-a-local-audit-of-what-your-coding-agent-did-and-why", "markdown": "https://wpnews.pro/news/show-hn-stroq-a-local-audit-of-what-your-coding-agent-did-and-why.md", "text": "https://wpnews.pro/news/show-hn-stroq-a-local-audit-of-what-your-coding-agent-did-and-why.txt", "jsonld": "https://wpnews.pro/news/show-hn-stroq-a-local-audit-of-what-your-coding-agent-did-and-why.jsonld"}}